CVE-2025-56526

Kotaemon version 0.11.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to the unsanitized rendering of content extracted from PDF files. Specifically, text, table markings, and image metadata are injected into the DOM without escaping, allowing a crafted PDF to execute arbitrary JavaScrip...